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1 About GfK and the Survey 


GfK 


You (“you”, “your”, “Respondent”) are about to take an online survey (the “Survey”, “Surveys”) 
conducted by GfK ("GfK", “we” / “us” / “our”, see section “Contact Information”). We are based in the 
United States. We process your personal data in compliance with applicable data protection law 
and other statutory provisions. GfK is part of a global organization (the “GfK Group”), consisting of 
several companies in and outside the European Union, all predominantly owned by GfK SE in 
Germany. This Privacy Notice explains what types of personal data concerning you are processed 
in the course of your participation in the Survey. 

2 What are personal data? 

Personal data is information that directly or indirectly identifies you as an individual, indirectly 
meaning when combined with other information, for example, your name, postal address, email 
address and phone number, or a unique online or digital device identifier. 

3 Use of personal data 

We process your personal data for the purposes as described below. We do not collect and process 
more or other types of personal data than are necessary to fulfill the respective purposes pursued 
by GfK or a client. We will only use personal data as set forth in this Privacy Policy. 

3.1 Categories of personal data that are processed in the course of Surveys 

We process as a data controller the following categories of personal data: 

1. “Survey Data”, meaning the your answers to surveys, which may inadvertently include 
personal data, 

2. your “Pseudonym”, meaning an identification number that is assigned to you when you 
click on the Survey link in the invitation email you received, 

3. “Meta Data”, meaning personal data collected in the background during a Survey, such 
as by means of browser cookies or internet log files. 

However, your “Contact Information”, like name email address or phone number are not in our 
possession and we do not have access to those, since they are processed by a Fieldwork 
Partner; see section 5. 
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3.2 How we use your personal data 


GfK 


We analyze and evaluate Survey Data to fulfill our market research purposes. We report Survey results to our 
clients in a form that does not personally identify you. Typically, we aggregate the Survey Data with the Survey 
Data of other Respondents. In some cases we may report the Survey Data on a Respondents’ level, using your 
Pseudonym instead of your name. 

We use Meta Data pursuant to our Cookie Policy to enhance the users’ experience and improve the performance, 
user friendliness and security of the Surveys, to analyze patterns of behavior and for purposes of quality 
assurance, including the prevention and detection of fraud and of disruption or damage to our IT systems. 

We may be required to use and retain personal data for legal and compliance reasons, such as the prevention, 
detection, or investigation of a crime, loss prevention, fraud or any other abuse of our services and IT systems. 

We may also use your personal data to meet our internal and external audit requirements, eliminate fraud, 
information security purposes, or to protect or enforce our rights, privacy, safety, or property, or those of other 
persons. 

3.3 How we use cookies, similar technologies and log data with our online surveys 

We store cookies and local storage data from GfK domains (including domains and subdomains other 
than the survey domain) on your device that include random unique identifiers. GfK’s cookies are 
generated and stored on a user’s computer when an Internet browser visits a survey page delivered by 
GfK. The GfK cookie does not include your name, address, phone number, email address, or any other 
personally identifiable information. The cookies do not capture what is done on a given website. The data 
we collect via the cookie technology is generally considered pseudonymous. 

We then interrogate the saved values upon survey entry with existing entries in the survey to determine if 
a survey was previously entered and completed from the same device and to understand what websites a 
given device visits. Cookies we set are stored for a period of 2 years at the longest unless you manually 
delete them. Data in local storage are persistent. You can delete them manually. 

4 How we share personal data 

4.1 Within GfK Group 

We may transfer your personal data to one or more GfK Group affiliated companies as needed for 
data processing and storage, providing you with access to our Surveys, providing support, making 
decisions about service improvements, content development and for other purposes as described in 
Section 3 of this Privacy Policy. We do not disclose personal data of Respondents to third parties 
outside the GfK Group unless Respondents have declared their prior explicit consent for the specific 
purpose. 
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4.2 External service providers 

Where necessary, we will commission other companies and individuals to perform certain tasks 
contributing to our services on our behalf within the framework of data processing agreements. For 
example, we use Dstillery as a third party data source to enrich our data. We may use, at our 
discretion, service providers, contractors or partners for hosting our databases and applications, for 
data processing services, or to send you information that you requested. We will only share with or 
make accessible such data to external service providers to the extent required for the respective 
purpose. This data may not be used by them for any other purposes, in particular not for their own 
or third party purposes. GfK’s external service providers are contractually bound to respect the 
confidentiality of your personal data. 
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4.3 Business transfers 

In connection with any reorganization, restructuring, merger or sale, or other transfer of assets 
(collectively "Business Transfer"), we will transfer data, including personal data, in a reasonable scale 
and as necessary for the Business Transfer, and provided that the receiving party agrees to respect 
your personal data in a manner that is consistent with applicable data protection laws. We will 
continue to ensure the confidentiality of any personal data and give affected users notice before 
personal data become subject to a different Privacy Policy. 

4.4 Public bodies 

We will only disclose your personal data to public bodies where this is required by law. GfK will for 
example respond to requests from courts, law enforcement agencies, regulatory agencies, and other 
public and government authorities, which may include such authorities outside your country of 
residence. 

5 Fieldwork Partners 

We work with other companies who source participants in the Survey. These may be other GfK 
Group companies or external suppliers (together “Fieldwork Partners”). Fieldwork Partners invite 
you to take part in the Survey. Fieldwork Partners have your Contact Information in their 
possession, otherwise they could not invite you, but they do not share it with us. 

6 International transfers of personal data 

Under specific circumstances, it will also be necessary for GfK to transfer your personal data to 
countries outside the United States and the European Union/ European Economic Area (EEA), so 
called "third countries". Such third country transfers may refer to all processing activities describes 
under Sec. 3 of this Privacy Policy. This Privacy Policy shall apply even if we transfer personal data 
to third countries, in which a different level of data protection applies than in your country of 
residence. In particular, an international data transfer may apply in the following scenarios: 

6.1 Legal entities of GfK Group 

GfK Group’s legal entities outside the European Union have entered into intra-company data 
protection agreements using standard contractual clauses adopted by the European Commission to 
safeguard your privacy and legitimize international data transfers. 

6.2 Other third parties outside the European Union (EU) and the European 
Economic Area (EEA) 

Any transfers of personal data to third parties outside the GfK Group will be carried out with your 
prior knowledge and, where applicable, with your consent. Any transfers of personal data into 
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countries other than those for whom an “adequacy decision”* regarding the level of data protection 
was made by the European Commission occur on the basis of contractual agreements using 
standard contractual clauses adopted by the European Commission or other appropriate 
safeguards in accordance with the applicable law 


*) See https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacv-protection- 

personal-data-non-eu-countries en 

7 Security 

GfK takes data security seriously. We apply an appropriate level of security and have therefore 
implemented reasonable physical, electronic, and administrative procedures to safeguard the data 
we collect from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or 
access to personal data transmitted, stored or otherwise processed. Our information security policies 
and procedures are closely aligned with widely accepted international standards and are reviewed 
regularly and updated as necessary to meet our business needs, changes in technology, and 
regulatory requirements. Access to your personal data is granted only to those personnel, service 
providers or GfK affiliates with a business need-to-know or who require it in order to perform their 
duties. 

In the event of a data breach containing personal data, GfK will follow all applicable data breach 
notification laws. 

8 Your legal rights 

As a data subject, you have specific legal rights relating to the personal data we collect from you. This 
applies to all processing activities explained in Section 3 of this Privacy Policy. GfK will respect your 
individual rights and will deal with your concerns adequately. 

The following list contains information on your legal rights, which arise from applicable data protection 
law: 


• Right to withdraw consent: Where the processing of personal data is based on your 
consent you may withdraw this consent at any moment. Please see section 11 “Contact 
information, data controller and exercise of your legal rights”. As a Respondent please note 
that by withdrawing consent you typically end your participation in the respective project 
and will no longer be eligible for any rewards or incentives that GfK may eventually offer to 
Respondents. 
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• Right to rectification: You may obtain from us rectification of personal data concerning you. 
We make reasonable efforts to keep personal data in our possession or control which are 
used on an ongoing basis, accurate, complete, current and relevant, based on the most 
recent information available to us. In appropriate cases, we provide self-service internet 
portals where users have the possibility to review and rectify their personal data. 


• Right to restriction: You may obtain from us restriction of processing of your personal data, 
if 

you challenge the accuracy of your personal data for the period we need to verify the 
accuracy, 

the processing is unlawful and you request the restriction of processing rather than 
erasure of your personal data, 

we do no longer need your personal data but you require them for the establishment, 
exercise or defense of legal claims, or 

you object to the processing while we verify whether our legitimate grounds override 
yours. 

• Right to access: You may ask us from us information regarding personal data that we hold 
about you, including information as to which categories of personal data we have in our 
possession or control, what they are being used for, where we collected them, if not from you 
directly, and to whom they have been disclosed, if applicable. You may obtain from us one 
copy, free of charge, of personal data we hold about you. We reserve the right to charge a 
reasonable fee for each further copy you may request. 

• Right to portability: At your request, we will transfer your personal data to another controller, 
where technically feasible, provided that the processing is based on your consent or 
necessary for the performance of a contract. Rather than receiving a copy of your personal 
data you may request that we transfer the data to another controller, specified by you, directly. 

• Right to erasure: You may obtain from us erasure of your personal data, where 

the personal data are no longer necessary in relation to the purposes for which they 
were collected or otherwise processed; 

you have a right to object further processing of your personal data (see below) and 
execute this right object to the processing; 

the processing is based on your consent, you withdraw your consent and there is no 

other legal ground for the processing; 

the personal data have been unlawfully processed; 
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unless the processing is necessary 

for compliance with a legal obligation which requires processing from us; 
in particular for statutory data retention requirements; 
for the establishment, exercise or defense of legal claims. 

• Right to object: You may object - at any time - to the processing of your personal data due 
to your particular situation, provided that the processing is not based on your consent but on 
our legitimate interests or those of a third party. In this event we shall no longer process your 
personal data, unless we can demonstrate compelling legitimate grounds and an overriding 
interest for the processing or for the establishment, exercise or defense of legal claims. If you 
object to the processing, please specify whether you wish the erasure of your personal data 
or the restriction of its processing by us. 

• Right to lodge a complaint: In case of an alleged infringement of applicable privacy laws, 
you may lodge a complaint with the data protection supervisory authority in the country you 
live in or where the alleged infringement occurred. 

Please note: 

• Time period: We will try to fulfill your request within 30 days. However, the period may be 
extended due to specific reasons relating to the specific legal right or the complexity of your 
request. 

• Restriction of access: In certain situations we may not be able to give you access to all or 
some of your personal data due to statutory provisions. If we deny your request for access, 
we will advise you of the reason for the refusal. 

• No identification: In some cases, we may not be able to look up your personal data due to 
the identifiers you provide in your request. For example, we cannot look up your Survey Data 
and Meta Data when you provide your name and email address and were invited to a Survey 
by an external Fieldwork Partner (please see also section Fieldwork Partners “Fieldwork 
Partners”). 

In cases where we cannot identify you as a data subject, we are not able to comply with your 
request to execute your legal rights as described in this section, unless you provide additional 
information enabling your identification. 
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• Exercise your legal rights: In order to exercise your legal rights, please contact our Data 
Protection Officer in writing or text from, e.g. by email or letter. For contact information, please 
refer to the end of this Privacy Policy. 

You may wish to make a request in exercise of your legal rights with the Fieldwork Partner 
who invited you on our behalf to take part in the Survey. This way, you avoid disclosing 
your identity to us in the first place. If your request is concerning your Contact Information, 
the Fieldwork Partner will normally be the appropriate addressee of the request since we do 
not have access to your Contact Information. Should your request be related to personal 
data that are in our possession, the Fieldwork Partner will convey your request to us by 
reference to your Pseudonym and we will treat your request as if we received it from you 
directly. 

9 Retention of your personal data 

In general, we will delete the personal data we collected from you if they are no longer necessary to 
achieve the purposes for which they were originally collected. 

We typically retain Survey Data including Pseudonyms for a period of one (1) year. Should a longer 
retention period apply, we inform respondents accordingly in the email invitation or on the start page 
of the survey. 

We retain Meta Data for up to 2 years. 

We will not delete all of your personal data if you requested from us to refrain from re-contacting you 
in the future. For this purpose, GfK keeps records which contain information on people who do not 
want to be re-contacted in the future (e.g. by means of email newsletters or recruiting campaigns for 
market research projects). 

10 Changes to this Privacy Policy 

We reserve the right, at our discretion, to modify our privacy practices and update and make 
changes to this Privacy Policy at any time. For this reason, we encourage you to refer to this 
Privacy Policy each time before you take a Survey that is conducted or hosted by GfK. This Privacy 
Policy is current as of the "last revised” date indicated above. We will treat your personal data in a 
manner consistent with the Privacy Policy under which they were collected, unless we have your 
consent to treat them differently. 
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11 Contact information, data controller and 
exercise of your legal rights 

Please direct your questions regarding the subject matter of data protection and any requests in the 
exercise of your legal rights to the Data Protection Officer: dpo germanv@qfk.com . 


GfK SE 

Nordwestring 101 
90419 Nuremberg 
Germany 


Management: 

Peter Feld (CEO), 
Lars Nordmark (CFO) 


T +49 911 395-0 (Switchboard) 
gfk@gfk.com 


Registered office: Nuremberg 

Entered in the Commercial Register at the 

District Court: 

Nuremberg: HRB 25014 
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